﻿/*************************************************************************
* 计算机名：AA-FA-05
* CLR 版本：4.0.30319.42000
* 命名空间: Unity
* 类    名：BaseEventArgs
* 当 前 域：HYRC
* 创 建 人：dailuyu
* 创建时间：2021/6/11 16:51:52
* 描    述：
*  V0.01 2021 初版
*
*  Copyright (c) 2021 aatsr Corporation. All rights reserved.
*  ┌──────────────────────────────────┐
*  │　此技术信息为本公司机密信息，未经本公司书面同意禁止向第三方披露．　│
*  └──────────────────────────────────┘
***************************************************************************/
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Text.RegularExpressions;

namespace Unity
{
    /// <summary>
    /// 验证是否带有sql注入语句
    /// </summary>
    public class ValidateSqlHelper
    {
        #region public static string JudgeIsExistSql(string strWhere) 验证是否带有sql注入语句
        /// <summary>
        /// 判断输入数据是否带sql入侵语句
        /// </summary>
        /// <param name="strWhere"></param>
        /// <returns></returns>
        public static string JudgeIsExistSql(string strWhere)
        {
            string newwhere = string.Empty;
            string SqlStr = @"and|or|exec|execute|insert|select|delete|update|alter|create|drop|count|\*|chr|char|asc|mid|substring|master|truncate|declare|xp_cmdshell|restore|backup|net +user|net +localgroup +administrators";
            try
            {
                if (!string.IsNullOrEmpty(strWhere))
                {
                    string strRegex = @"\b(" + SqlStr + @")\b";
                    Regex regex = new Regex(strRegex, RegexOptions.IgnoreCase);
                    if (regex.IsMatch(strWhere))
                    {
                        newwhere = string.Empty;
                    }
                    else
                    {
                        newwhere = strWhere;
                    }
                }
            }
            catch
            {
                newwhere = string.Empty;
            }
            return newwhere.Replace("'", "");
        }
        #endregion
    }
}
